@@ -15,10 +15,10 @@ import (
1515 "net/url"
1616 "time"
1717
18+ "github.com/coreos/go-oidc/jose"
1819 homedir "github.com/mitchellh/go-homedir"
1920 "github.com/pkg/errors"
2021 gossh "golang.org/x/crypto/ssh"
21- "gopkg.in/square/go-jose.v2/jwt"
2222
2323 "github.com/cloudflare/cloudflared/config"
2424 cfpath "github.com/cloudflare/cloudflared/token"
@@ -87,33 +87,37 @@ func SignCert(token, pubKey string) (string, error) {
8787 return "" , errors .New ("invalid token" )
8888 }
8989
90- parsedToken , err := jwt . ParseSigned (token )
90+ jwt , err := jose . ParseJWT (token )
9191 if err != nil {
9292 return "" , errors .Wrap (err , "failed to parse JWT" )
9393 }
9494
95- claims := jwt.Claims {}
96- err = parsedToken .UnsafeClaimsWithoutVerification (& claims )
95+ claims , err := jwt .Claims ()
9796 if err != nil {
9897 return "" , errors .Wrap (err , "failed to retrieve JWT claims" )
9998 }
10099
100+ issuer , _ , err := claims .StringClaim ("iss" )
101+ if err != nil {
102+ return "" , errors .Wrap (err , "failed to retrieve JWT iss" )
103+ }
104+
101105 buf , err := json .Marshal (& signPayload {
102106 PublicKey : pubKey ,
103107 JWT : token ,
104- Issuer : claims . Issuer ,
108+ Issuer : issuer ,
105109 })
106110 if err != nil {
107111 return "" , errors .Wrap (err , "failed to marshal signPayload" )
108112 }
109113 var res * http.Response
110114 if mockRequest != nil {
111- res , err = mockRequest (claims . Issuer + signEndpoint , "application/json" , bytes .NewBuffer (buf ))
115+ res , err = mockRequest (issuer + signEndpoint , "application/json" , bytes .NewBuffer (buf ))
112116 } else {
113117 client := http.Client {
114118 Timeout : 10 * time .Second ,
115119 }
116- res , err = client .Post (claims . Issuer + signEndpoint , "application/json" , bytes .NewBuffer (buf ))
120+ res , err = client .Post (issuer + signEndpoint , "application/json" , bytes .NewBuffer (buf ))
117121 }
118122
119123 if err != nil {
0 commit comments